Our system has found that you are using an ad-blocking browser add-on.

We just wanted to let you know that our site content is, of course,
available to you absolutely free of charge.

Our ads are the only way we have to be able to bring you the latest
high-quality content, which is written by professional journalists,
with the help of editors, graphic designers, and our site production
and I.T. staff, as well as many other talented people who work around the clock
for this site.

So, we ask you to add this site to your Ad Blocker’s "white list" or
to simply disable your Ad Blocker while visiting this site.

On the 10th anniversary of Patch Tuesday, Microsoft released eight security bulletins. Four of the October bulletins are rated Critical and four are rated Important. But the Internet Explorer patch is getting the most attention.

“Microsoft has addressed 27 CVEs this month. Many people will be happy to see MS13-80, a critical patch for 10 vulnerabilities in Internet Explorer 6 through 11,” Paul Henry, a security and forensics analyst at Lumension, told us.

“There are two known attacks underway so the IE patch should be your priority number one. This patches CVE -2013-3893, a zero day vulnerability Microsoft wrote about in Security Advisory 2887505 September 17.”

Why Wasn’t It Released Earlier?

Wolfgang Kandek, CTO at Qualys, told us the discussion around a potential earlier release of MS13-080 depended on the number of ongoing attacks Microsoft and the security community detected. Since the volume continued to stay low, even after Metasploit added its implementation, he explained, Microsoft opted for a normal release schedule during Patch Tuesday. This move places the least stress on IT organizations during a month where there’s plenty of stress already.

MS13-080 also addresses CVE-2013-3897 in an interesting case that Kandek says illustrates the concurrent discoveries of vulnerabilities. Microsoft found the vulnerability underlying CVE-2013-3897 internally and it would have been fixed in MS13-080 as part of the normal security engineering and hardening that the product undergoes constantly, Kandek explained.

“However, in the last two weeks, attacks against the same vulnerability became public, again limited and targeted in scope, but since the fix was in the code already, it enabled Microsoft to address the vulnerability, CVE ID CVE-2013-3897, in record time,” he said. “By the way the same, but less public reasoning about attack volume as for CVE-2013-3893 has been applied in this case as well: If there had been widespread reports of the vulnerability being used to exploit networks, it would have triggered an out-of-band release.”

“This is a genuine article -- a real, honest-to-goodness, potentially ‘wormable’ condition. If the ‘bad guys’ figure out a way to automate the exploitation of this, it could spread rapidly and the defense in depth measures of your organization will be tested. However, this vulnerability was privately reported to Microsoft and is not known to be under active exploitation,” he said.

“On top of all that, there are four MS Office vulnerabilities. These issues have only been tagged as 'important' for one reason or another. Don't ignore them, but patch the other issues in this month’s advisory first if you have to make that kind of decision,” he added.

A Month of Headaches

Overall, Kandek called October a challenging and busy month with the high priority Internet Explorer patches and the additional patching from Adobe, plus the patches for next week that we can expect for all Oracle products, including Java.

“Our perspective has certainly evolved from 10 years ago when Patch Tuesday was started -- back then vulnerabilities were clear cut and straightforward to understand. Today the amount of complexity that goes into the detection and remediation process is truly impressive,” he said.

“At the same time, attackers have shifted to client side vulnerabilities, a change that we only partly assimilated. We are good in addressing the browser vulnerabilities, but generally lag behind in other areas that will be in focus this month such as Adobe Reader and Java,” he added.